JP3798397B2 - Access management system and access management device - Google Patents

Description

  The present invention relates to a system for lending and borrowing an internet connection band between users.

  For example, Patent Document 1 discloses a communication method that enables the lease of a bandwidth of a broadband communication line. As shown in FIG. 12, the line operator device 800 is connected to the Internet, and the mobile PC 840 performs wireless communication with the line lender device 820 connected to the line operator device 800. The network operator device 800 includes an authentication device for authenticating the mobile PC 840 and a charging device for charging the mobile PC 840. Further, an encryption device is provided that encrypts a transmission signal to the mobile PC 840 and decrypts a reception signal from the mobile PC 840. The line lender device 820 includes a line control device that controls the bandwidth used for the line, and a wireless LAN device having an access point.

  Mobile PC 840 connects to the wireless LAN device and authenticates line lender device 820. The line lender device 820 generates a packet with the IP address assigned to the mobile PC 840 and sends it to the line provider device 800. Further, by relaying a control packet addressed to the mobile PC 840 from the line operator device 800, a session is established between the mobile PC 840 and the line operator device 800.

  The network operator device 800 authenticates the mobile PC 840 based on the user information (ID information, authentication number, etc.) sent by the mobile PC 840. Communication data from the mobile PC 840 is encrypted by the mobile PC 840, decrypted by the encryption device of the network operator device 800, and transferred to the communication device 860 on the Internet. In addition, communication data from the Internet to the mobile PC 840 is encrypted by a line provider encryption device and transmitted to the mobile PC 840.

  Thus, the mobile PC 840 communicates with the communication device 860 on the Internet, and when the communication is completed, the charging device of the line operator device 800 records the user ID information and usage time of the mobile PC 840, and Make a charge.

JP 2002-344511 A

  However, in the communication method described above, the user of the mobile PC 840 must pay a line usage fee according to the usage record, and the payment procedure is complicated. Also, when the line lender himself uses the mobile PC to perform the above communication method, a payment procedure for the line usage fee is required, and the bandwidth of the communication line cannot be easily used. It is an object of the present invention to provide an access management system, apparatus, and the like that solve such problems and simplify the use of the Internet connection band between specific users and prevent unauthorized use.

  This invention becomes a relay device lender and opens the connection band to the terminal device user, so that when the lender himself becomes a user of the terminal device, the relay device of another person opens. This makes it easy to use the connection bandwidth.

  (1) An access right management system according to the present invention includes: A) a relay device that wirelessly communicates with a terminal device in a reception area; B) communication with the relay device; and a user of the terminal device is a third party An access right management system comprising an access right management device having a management table for storing an access right to access the Internet via the relay device, and C) the terminal device via the relay device. Means for connecting to the access right management device and transmitting the user identification information of the terminal device to the access right management device via the relay device; and D) the relay device performs access via the relay device. Lender identification information transmitting means for transmitting lender identification information of a lender to be lent to the access right management device is provided. E) The access right management device is e1) User identification of the terminal device Information and identification information acquisition means for acquiring lender identification information of the relay device, e2) authentication means for authenticating a user of the terminal device and a lender of the relay device, and e3) the terminal device in the management table Connection control means for enabling connection of the terminal device to a server device on the Internet based on the access right of the user, and e4) the terminal device based on the usage amount of the Internet via the relay device, Access right management means for reducing the access right of the user of the terminal device in the management table and increasing the access right of the lender who has lent access through the relay device.

  Therefore, the access rights of both the user of the terminal device and the lender of the relay device are fluctuated, and the access right to the Internet is lent and borrowed between the user of the terminal device and the lender of the relay device (of the internet connection bandwidth). Lending and borrowing). For this reason, it is not necessary to perform a charging procedure between the user of the terminal device and the lender of the relay device, and the use of the Internet connection band between specific users can be simplified.

  Specifically, the lender of the relay device increases the access right of the lender himself by allowing the user of the terminal device to use the relay device, while the lender himself becomes a user of the terminal device. Thus, it is possible to connect to the Internet using another person's relay device based on his / her access right.

  In addition, since the user of the terminal device and the lender of the relay device are authenticated in the access right management device, unauthorized use in which the user of the terminal device impersonates the lender of the relay device can be prevented.

(2) In the access management system according to the present invention , the relay device obtains user identification information from the terminal device, and a determination means for determining whether or not the user of the terminal device is the same as the lender of the relay device. The lender identification information transmitting means is characterized in that when the user of the terminal device is not the same as the lender of the relay device, the lender identification information of the relay device is transmitted to the access right management device.

  Therefore, when the user of the terminal device uses another person's relay device, the lender identification information of the relay device is transmitted to the access right management device. For this reason, in the access management apparatus, the access rights of both the terminal device user and the relay device lender can be varied.

(3) In the access management system according to the present invention, when the user of the terminal device is the same as the lender of the relay device, the relay device is connected to the server device on the Internet without going through the access right management device. Means are provided for enabling the apparatus to be connected.

  Therefore, when the user of the terminal device uses the user's own relay device, it is not necessary to rent or borrow the access right, and it is possible to connect to the Internet without going through the access right management device.

  (4) In the access management system according to the present invention, the terminal device is connected to the access management device by connecting a portable device having a program for connecting to the access right management device to the communication port of the terminal device. It is characterized by doing. Therefore, the terminal device or the mobile device can connect to the access management device by executing the program of the mobile device.
  (5) In the access management system according to the present invention, the mobile device stores user identification information of the terminal device, and the user identification information is transmitted to the relay device and the access management device. Therefore, the user identification information of the terminal device can be easily transmitted by using the user identification information stored in the portable device.

(6) The access right management device according to the present invention can communicate with a relay device that wirelessly communicates with a terminal device in a reception area, and a user of the terminal device accesses the Internet via a third-party relay device. An access right management device comprising a management table for storing access rights to be used, the user identification information of the terminal device and the lender identification information of a lender who lends access to the terminal device via a relay device Based on the access right of the user of the terminal device in the management table based on the access right of the user of the terminal device in the management table, the authentication information for authenticating the user of the terminal device and the lender of the relay device Connection control means for enabling connection of the terminal device to the device, and based on the Internet usage by the terminal device, Serial and an access right management means for increasing access lender that lent access via the relay apparatus with reducing the user's access terminal.
In this way, by changing the access rights of both the terminal device user and the relay device lender, the access right to the internet is lent and borrowed between the terminal device user and the relay device lender (Internet connection). You can borrow and borrow bandwidth. For this reason, it is not necessary to perform a charging procedure between the user of the terminal device and the lender of the relay device, and the use of the Internet connection band between specific users can be simplified.
(7) In the access management system according to the present invention , the terminal device includes means for connecting to the server device via the access right management device and transmitting a data transfer request, and the server device includes the access right management device. Means for transmitting data requested to be transferred to the terminal device, the access right management means reduces the access right of the user of the terminal device in the management table based on the amount of data transferred to the terminal device, The access right of the lender of the relay device is increased. Therefore, the access right can be lent and borrowed based on the amount of data transferred to the terminal device.

  (9) A relay computer according to the present invention includes a communication circuit that wirelessly communicates with a terminal device in a reception area, a first route for transmitting data from a target server computer on the Internet to the terminal device, and a purpose on the Internet A computer that selects a second route for transmitting data from a server computer to a terminal device via a management server computer, acquires user identification information from the terminal device, and the user of the terminal device relays the computer Determining means for determining whether the terminal device is the same as the owner of the computer, means for enabling the terminal device to be connected to the target server computer when the user of the terminal device is the same as the owner of the relay computer, If the user is not the same as the owner of the relay computer, the user identification information of the terminal device and the owner of the relay computer Information, characterized in that it comprises a means for transferring the target server computer.

  Therefore, when the user of the terminal device tries to connect to the Internet using another person's relay computer, the user can use the management server computer while using the user's own relay computer. Can be connected to the target server computer without going through the management server computer.

  (11) The Internet connection band lending / borrowing management method according to the present invention is communicable with a relay device that wirelessly communicates with a terminal device in a reception area, and a user of the terminal device passes through a third-party relay device. Using a computer having a management table for storing access rights to access the Internet, the internet connection bandwidth is lent and borrowed between the user of the terminal device and the lender who lends access to the terminal device via a relay device. A management method that causes a computer to execute the following processing. 1) a process of acquiring the user identification information of the user and the lender identification information of the lender, 2) authenticating the user and the lender based on the user identification information and the lender identification information Processing, 3) processing for enabling connection of the terminal device to a server device on the Internet based on the access right of the user of the terminal device in the management table, 4) based on the amount of Internet usage by the terminal device The process of decreasing the access right of the user of the terminal device in the management table and increasing the access right of the lender of the relay device by the reduced amount.
  In this way, by changing the access rights of both the terminal device user and the relay device lender, the access right to the internet is lent and borrowed between the terminal device user and the relay device lender (Internet connection). You can borrow and borrow bandwidth. For this reason, it is not necessary to perform a charging procedure between the user of the terminal device and the lender of the relay device, and the use of the Internet connection band between specific users can be simplified.
  (12) The Internet connection band lending / borrowing management method according to the present invention is an Internet connection band when a user of a wireless communication terminal device connects to the Internet via a third-party wireless communication relay device connected to the Internet. 1) The access right is stored for each user in a management server connected to the Internet, and 2) a specific relay device is transmitted from the terminal device by the user. When the connection request including the user ID is given, the specific relay device determines whether the given user ID and the user ID stored in the storage unit of the relay device are the same, 3 When the specific relay device determines that the user ID is different from the user ID, the specific relay device grants the access right to the user specified by the user ID to the management server. 4) When the management server refers to the access right for each user and determines that the user has the access right, the management server can access the relay device. 5) When the relay device receives such a reply, the terminal device can be connected to the Internet via the management server, and 6) the management server responds to the connection according to the connection. The user's access right is decreased and the user's access right specified by the user ID stored in the relay device is increased.
  In this way, by changing the access rights of both the terminal device user and the relay device lender, the access right to the internet is lent and borrowed between the terminal device user and the relay device lender (Internet connection). You can borrow and borrow bandwidth. For this reason, it is not necessary to perform a charging procedure between the user of the terminal device and the lender of the relay device, and the use of the Internet connection band between specific users can be simplified.

  In the present invention, the “terminal device” corresponds to the portable information terminal 40 in the following embodiment. A “relay device” is a device that wirelessly communicates with a terminal device in the reception area, and corresponds to the wireless LAN device 30 in the following embodiment. The “access right management device” is a device that manages the access rights of the user of the terminal device and the lender of the relay device, and corresponds to the management server 10 of the service center in the following embodiment. The “management table” is a table that stores the access rights of the user of the terminal device and the lender of the relay device, and corresponds to the access right management table 100 in the following embodiment. The “portable device” corresponds to the ID device 50 in the following embodiment.

  In the following embodiment, the “lender identification information transmitting means” of the relay device corresponds to the CPU 320 of the wireless LAN device 30 that performs the process of embedding the ID of the user B in the packet that passes through in step S16 of FIG. Further, the “discriminating means” of the relay device is a means for discriminating whether or not the user of the terminal device is the same as the lender of the relay device. In the following embodiment, step S12 in FIG. 5, step S82 in FIG. This corresponds to the CPU 320 of the wireless LAN device 30 that executes

  The “authentication means” is means for authenticating the user of the terminal device and the lender of the relay device, and corresponds to the CPU 120 of the management server 10 executing steps S18, S20, and S24 in FIG. 5 in the following embodiment. . The “connection control means” is means for enabling connection of a terminal device to a server device on the Internet, and corresponds to the CPU 120 of the management server 10 that executes step S30 in FIG. 5 in the following embodiment. The “access right management means” is means for changing the access rights of the user of the terminal device and the lender of the relay device in the management table. In the following embodiment, the access right management means of the management server 10 executing step S38 in FIG. Corresponds to CPU120.

  The “relay computer” corresponds to the wireless LAN device 30 in the following embodiment. The “management server computer” corresponds to the management server 10 in the following embodiment. The “target server computer” corresponds to the WWW server 20 in the following embodiment. The “program” is a concept that includes not only a program that can be directly executed by the CPU, but also a source format program, a compressed program, an encrypted program, and the like.

1. Overall Configuration, Hardware Configuration of Each Device FIG. 1 shows an example of the overall system configuration according to an embodiment of the present invention. The management server 10, the WWW server 20, and the wireless LAN device 30 are connected to the Internet. The portable information terminal 40 is used by the user A and is located in the reception area of the wireless LAN device 30. The wireless LAN device 30 is owned by the user B, functions as an access point that relays communication data between the portable information terminal 40 and the management server 10, and is always connected to the Internet. This is, for example, connected to the Internet using an ADSL (Asymmetric Digital Subscriber Line) method capable of high-speed communication using a conductor of an existing public telephone line.
The management server 10 is installed in the service center, authenticates the users A and B of the portable information terminal 40 and the wireless LAN device 30, and relays communication data between the portable information terminal 40 and the WWW server 20. In addition, an access right table 100 for storing the access right to the Internet of the user who is a member is provided, and a lending / borrowing service for the Internet connection band between the users is provided. The WWW server 20 provides a website to which the user A of the portable information terminal 40 is to connect.

  As shown in FIG. 2, the ID device 50 is an apparatus that is attached to the USB connector 400 of the portable information terminal 40 and realizes automatic connection to the management server 10 via the wireless LAN device 30.

  FIG. 3A shows a hardware configuration example of the management server 10. The management server 10 includes a CPU 120, a display 122, an input unit 124, a memory 126, a hard disk 128, a CD-ROM drive 130, a communication circuit 132, and the like connected via a bus line. The hard disk 128 is portable via the access right table 100 for storing points representing access rights to the Internet, the user table 140 for storing member user information (user ID, password, public key), and the management server 10. A data amount storage unit 142 for storing the amount of data transmitted to the information terminal 40, an authentication program for authenticating a user, an access right management program for changing access rights, an operating system (OS), and the like are stored. ing. Note that the authentication program and the like are installed from the CD-ROM 134 via the CD-ROM drive 130, and each executes processing in cooperation with the operating system. The hardware configuration of the WWW server 20 is basically the same as that shown in FIG. 3A, and includes a CGI (Common Gateway Interface) program for transmitting a web page requested to be transferred.

  FIG. 3B shows a hardware configuration example of the wireless LAN device 30. The wireless LAN device 30 includes a CPU 320 connected via a bus line, a storage unit 322 that stores owner information (user B ID, password, public key, etc.), and an antenna that transmits and receives signals to and from the portable information terminal 40. A communication circuit 324 and a communication circuit 326 for communicating with a computer on the Internet are provided.

  FIG. 4A shows a hardware configuration example of the portable information terminal 40. The portable information terminal 40 includes a CPU 420 connected via a bus line, a display 422, an input unit 424, a memory 426, a hard disk 428, a USB connector 400 connected to the ID device 50, a slot 430 into which a wireless LAN card is inserted, etc. It has. The hard disk 428 stores a browser program for connecting to the Internet, an operating system (OS), and the like.

  FIG. 4B shows a hardware configuration example of the ID device 50. The ID device 50 includes a CPU 520 connected via a bus line, a ROM 522 that stores user information (user ID, password, secret key, etc.), an automatic connection program, and the like, a RAM 524, a USB connector 526, and the like. The automatic connection program is for automatically connecting to the management server 10 via the wireless LAN device 30.

2. Contents of Processing FIGS. 5 and 6 show processing of each device when the user A connects to the WWW server 20 from the portable information terminal 40 using the ID device 50. FIG.
When user A attaches ID device 50 to portable information terminal 40, CPU 520 executes an automatic connection program. As a result, the portable information terminal 40 monitors the radio wave of the wireless LAN device 30 to detect the carrier, transmits a call signal, and connects to the wireless LAN device 30 (step S10 in FIG. 5). At this time, the ID of the user A is transmitted to the wireless LAN device 30.

  The wireless LAN device 30 collates the ID of the user A received from the portable information terminal 40 with the ID of the user B stored in the storage unit 322, and determines that the user of the portable information terminal 40 is not the user B (FIG. 5). Step S12). That is, if it is determined that the wireless LAN device 30 is not the owner (owner), an IP address is assigned to the portable information terminal 40 and a wireless link is permitted (step S14 in FIG. 5).

  Next, the portable information terminal 40 connects to the management server 10 of the service center via the wireless LAN device 30, and transmits the ID of the user A to the management server 10 via the wireless LAN device 30 (step S16 in FIG. 5). . At this time, in the wireless LAN device 30, the ID (owner ID) of the user B is embedded in the packet that passes through and is transmitted to the management server 10. Note that the destination address of the management server 10 is included in the automatic connection program, and the CPU 520 executes the automatic connection program, whereby automatic connection to the management server 10 is performed.

  The management server 10 authenticates the wireless LAN device 30 (owner) based on the user table 140 shown in FIG. 7A (step S18 in FIG. 5). That is, the validity of the wireless LAN device 30 is confirmed when the ID of the user B is registered in the user table 140. When the validity of the wireless LAN device 30 is confirmed, the mobile information terminal 40 is authenticated by a so-called challenge / response method. That is, the management server 10 transmits a challenge code randomly generated using a random number to the portable information terminal 40 via the wireless LAN device 30 (step S20 in FIG. 5).

  The ID device 50 generates a response code by encrypting with the secret key from the received challenge code and password (step S22 in FIG. 5). A password and a secret key stored in the ROM 522 are used. Then, the response code is transmitted to the management server 10 via the wireless LAN device 30.

  The management server 10 decrypts the received response code with the public key corresponding to the user A's private key. This public key is stored in the user table 140 shown in FIG. 7A and is specified from the ID of the user A. Then, the value calculated from the challenge code and password transmitted earlier is compared with the decryption result, and if they match, the validity of the portable information terminal 40 is confirmed (step S24 in FIG. 5).

  When the validity of the wireless LAN device 30 and the portable information terminal 40 is confirmed in this way, the management server 10 determines whether or not the portable information terminal 40 (user A) may be permitted to connect to the Internet. That is, it is determined based on the point of the user A in the access right table 100 shown in FIG. 8A whether or not the user A currently has the right to access the Internet (step S26 in FIG. 5). If the point of user A remains, it is determined that there is an access right to the Internet (step S28 in FIG. 5). If no points remain, a request for data transfer from the portable information terminal 40 to the Internet is not accepted (step in FIG. 6).

  Here, since the point of the user A at the present time is “400”, it is determined that there is an access right, and permission to connect to the Internet is notified to the portable information terminal 40 via the wireless LAN device 30 (step S30 in FIG. 5). ). As a result, tunneling is established between the portable information terminal 40 and the management server 10, and communication data between the portable information terminal 40 and the computer on the Internet is always transmitted via the management server 10.

  Next, the user A inputs the URL of the website provided by the WWW server 20 into the portable information terminal 40 (step S32 in FIG. 5). The portable information terminal 40 connects to the WWW server 20 via the wireless LAN device 30 and the management server 10 and makes a web page transfer request (step S34 in FIG. 5). At this time, the request packet to which the destination address is added is subjected to tunneling encryption and wireless section encryption in the portable information terminal 40 and transmitted to the wireless LAN device 30. The encryption for tunneling uses a session key generated using a secret key stored in the ID device 50 and a public key stored in the management server 10. The wireless section encryption is removed in the wireless LAN device 30 and transmitted to the management server 10. The encryption for tunneling is removed in the management server 10 and transmitted to the WWW server 20. This decryption uses the session key described above.

  The WWW server 20 transmits the web page that has received the transfer request from the portable information terminal 40 to the portable information terminal 40 via the management server 10 and the wireless LAN device 30 (step S36 in FIG. 5). At this time, the management server 10 secures a route for reliably transmitting the packet on the network from the WWW server 20 to the portable information terminal 40 (routing process), and performs the access right variation process shown in FIG. 5 step S38).

  The management server 10 records the data amount of the packet transmitted in this routing process in the data amount storage unit 142 shown in FIG. 7B in association with the IDs of the user A and the user B (step S60 in FIG. 6). Further, the access rights (points) of the users A and B in the access right table 100 shown in FIG. 8A are changed based on the amount of data to be transmitted.

  For example, the point “10” is calculated based on the data amount of the packet passing through the management server 10 (step S62 in FIG. 6), and subtracted from the original point “400” of the user A to obtain the access right of the user A. The point is “390”. On the other hand, the point “10” is added to the original point “700” of the user B, and the access right of the user B is set to the point “710” (step S64 in FIG. 6). That is, the access right of the user A who borrowed the Internet connection band is decreased, and the access right of the user B (owner) who lent it is increased.

  While the portable information terminal 40 is connected to the Internet, as long as points remain, the calculation / variation of points based on the data amount described above is repeated (steps S68 and S70 in FIG. 6). If the points are lost, a new transfer request from the portable information terminal 40 is not accepted (step S72 in FIG. 6).

  As described above, the user A can use the wireless LAN device 30 of the user B without performing a charging procedure by using the access right of the user A himself / herself.

  In FIG. 9, when user B who is the owner in the above example becomes a user of the portable information terminal 70 / ID device 80 and connects to the Internet via the wireless LAN device 60 and the management server 10 of user C. The overall system configuration is shown. Further, FIG. 8B shows a variation example of the access right of the user B and the user C in the access right table 100.

  The point “5” based on the data amount of the packet transmitted to the portable information terminal 40 via the management server 10 is calculated, and the point “710” of the user B borrowing the connection bandwidth is reduced to “705”. On the other hand, the point “500” of user C who lent the connection bandwidth is increased to “505”.

  In this way, when user B becomes a lender of wireless LAN device 30, it is possible to increase the access right by releasing the connection band, and when user B becomes a user of portable information terminal 70, The connection band released by the wireless LAN device 60 can be used based on the access right of the user B. That is, it is not necessary to perform a billing procedure between member users, and the internet connection band can be lent and borrowed.

  10 and 11 show the overall configuration of the system and the processing of each device when user B becomes a user of home PC 90 and connects to the Internet via wireless LAN device 30. FIG. The hardware configuration of the home PC 90 is basically the same as that shown in FIG. 4A.

  Home PC 90 wirelessly connects to wireless LAN device 30 and transmits user B's ID (step S80 in FIG. 11). The wireless LAN device 30 collates the ID of the user B received from the home PC 90 with the ID of the user B stored in the storage unit 322, and determines that the user of the home PC 90 is the user B (owner) (FIG. 11). Step S82).

  Here, the wireless LAN device 30 authenticates the home PC 90 by a challenge / response method in order to prevent an act of impersonation by a third party as an owner (steps S84, S86, S88 in FIG. 11).

  When the validity of the home PC 90 is confirmed, the wireless LAN device 30 allocates an IP address to the home PC 90 and permits connection to the Internet. When the URL is input by the user B, the home PC 90 connects to the WWW server 20 via the wireless LAN device 30 (steps S92 and S94 in FIG. 11).

  As described above, when the user B's own wireless LAN device 30 is used, it is not necessary to change the access right in the management server 10, and therefore the user B is directly connected to the WWW server 20 without going through the management server 10.

3. Other Examples In the above-described embodiment, the ID device 50 attached to the portable information terminal 40 is connected to the management server 10, but the wireless LAN device 30 may be connected to the management server 10. Good. Further, although encryption for tunneling is performed using the secret key stored in the ID device 50, the encryption may be performed in the wireless LAN device 30.
In the above-described embodiment, the CPU 520 of the ID device 50 executes the automatic connection program and connects to the management server 10, but the CPU 420 of the portable information terminal 40 reads the automatic connection program of the ID device 50, The management server 10 may be connected. Further, without using the ID device 50, the portable information terminal 40 itself may store the automatic connection program and connect to the management server 10.

  In the above-described embodiment, the ID (owner ID) of user B is embedded in the packet transmitted from the portable information terminal 40 in the wireless LAN device 30 and transmitted to the management server 10. However, the wireless LAN device 30 may transmit the owner ID to the portable information terminal 40 and transmit the owner ID from the portable information terminal 40 to the management server 10.

  In the above-described embodiment, the management server 10 authenticates the portable information terminal 40 by the challenge / response method (steps S20, S22, and S24 in FIG. 5), but the user A transmitted from the portable information terminal 40 You may authenticate only by ID.

  In the above-described embodiment, the wireless LAN device 30 assigns an IP address to the portable information terminal 40 before authenticating the portable information terminal 40 in the management server 10. However, a temporary IP address may be allocated to the portable information terminal 40 before authentication by the management server 10, and a formal IP address may be allocated to the portable information terminal 40 after authentication by the management server 10.

  In the above-described embodiment, the access right is changed during the Internet connection by the portable information terminal 40 (step S64 in FIG. 6). However, the access right may be changed after the connection is disconnected. In the above-described embodiment, points are calculated and varied based on the data amount of packets passing through the management server 10 (steps S62 and S64 in FIG. 6). However, points are calculated based on the Internet connection time and the number of packets. May be calculated and varied.

In the above-described embodiment, the management server 10 suspends the connection to the Internet when there are no user points (step S72 in FIG. 6). You may connect. In the embodiment described above, the management server 10 is connected via one wireless LAN device 30, but may be connected to the management server 10 via wireless LAN devices 30 of a plurality of users.

  In the above-described embodiment, the ID device 50 capable of USB connection is described as an example of the portable device, but any device that can be connected to the portable information terminal 40 regardless of wired wireless communication may be used. For example, a PC card, various memory cards, an IC card, an IC chip, or a mobile phone incorporating these is applicable.

In the above-described embodiment, the authentication program of the management server 10 implements the above function in cooperation with the OS . However, the authentication program or the like may realize part or all of the function alone. It may be.

1 is a diagram illustrating an overall configuration of a system according to an embodiment. 6 is a diagram when the ID device 50 is attached to the portable information terminal 40. FIG. 2 is a diagram illustrating a hardware configuration of a management server 10 and a wireless LAN device 30. FIG. 2 is a diagram showing a hardware configuration of a portable information terminal 40 and an ID device 50. FIG. 7 is a flowchart showing processing of the management server 10, the wireless LAN device 30, and the portable information terminal 40 (including the ID device 50). 4 is a flowchart showing access right change processing by the management server 10. 4 is a diagram showing a user table 140 and a data amount storage unit 142. FIG. It is a figure which shows an access right table. 1 is a diagram illustrating an overall configuration of a system according to an embodiment. 1 is a diagram illustrating an overall configuration of a system according to an embodiment. 4 is a flowchart showing processing of the wireless LAN device 30 and the portable information terminal 40 (including the ID device 50). It is a figure which shows the structure of the conventional system which enabled the lease of the band of a broadband communication line.

Explanation of symbols

10 ... Management server
20 ... WWW server
30, 60 ... Wireless LAN device
40, 70 ... ・ Personal digital assistant
50, 80 ... ID devices
90 ... Home PC
100 ... Access right table

Claims (12)

A) a relay device that wirelessly communicates with a terminal device in the reception area;
B) An access right management device comprising a management table that is communicable with the relay device and stores an access right for a user of the terminal device to access the Internet via a third party relay device ;
An access right management system comprising:
C) The terminal device includes means for connecting to the access right management device via the relay device and transmitting user identification information of the terminal device to the access right management device via the relay device,
D) The relay device includes lender identification information transmitting means for transmitting lender identification information of a lender who lends access via the relay device to the access right management device,
E) The access right management device
e1) identification information acquisition means for acquiring user identification information of the terminal device and lender identification information of the relay device;
e2) authentication means for authenticating a user of the terminal device and a lender of the relay device;
e3) connection control means for enabling connection of the terminal device to a server device on the Internet based on the access right of the user of the terminal device in the management table;
e4) The terminal device reduces the access right of the user of the terminal device in the management table based on the usage amount of the Internet through the relay device, and the lender who lent access through the relay device . An access right management means for increasing the access right;
An access right management system comprising: In the access right management system according to claim 1,
The relay device, when a user of the terminal device is not a lender of the relay device, enabling the terminal device to be connected to a server device on the Internet via the access right management device;
It is characterized by. In the access right management system according to claim 1,
When the user of the terminal device is the same as the lender of the relay device, the relay device enables the terminal device to be connected to a server device on the Internet without going through the access right management device. ,
It is characterized by. In the access right management system according to claim 1,
The terminal device includes a communication port to which a mobile device is connected,
When the portable device is connected to the communication port, the terminal device connects to the access management device based on a program for connecting to the access right management device stored in the portable device;
It is characterized by. In the access right management system according to claim 4,
The terminal device transmits user identification information stored in the portable device to the relay device or the access management device, thereby connecting the terminal device to the access management device;
It is characterized by. An access right comprising a management table that is communicable with a relay device that wirelessly communicates with a terminal device in a reception area, and stores an access right for a user of the terminal device to access the Internet via a third-party relay device A management device,
Identification information acquisition means for acquiring user identification information of the terminal device and lender identification information of a lender who lends access to the terminal device via a relay device ;
Authentication means for authenticating a user of the terminal device and a lender of the relay device;
Connection control means for enabling connection of the terminal device to a server device on the Internet based on the access right of the user of the terminal device in the management table;
Access right management that reduces the access right of the user of the terminal device in the management table and increases the access right of the lender who lents access through the relay device based on the Internet usage by the terminal device Means,
An access right management device comprising: The access right management device according to claim 6,
Upon receiving a data transfer request from the terminal device to the server device, means for transferring the request to the server device;
Means for receiving reply data to the data transfer request from the server device, and transmitting the data to the terminal device;
With
The access right management means reduces the access right of the user of the terminal device in the management table based on the amount of data transferred to the terminal device, and increases the access right of the lender of the relay device. ,
It is characterized by. A computer having a management table capable of communicating with a relay device that wirelessly communicates with a terminal device in a reception area, and storing an access right for a user of the terminal device to access the Internet via a third-party relay device A program for executing the following steps.
Obtaining user identification information of the terminal device and lender identification information of a lender who lends access to the terminal device via a relay device ;
Authenticating a user of the terminal device and a lender of the relay device;
Making the terminal device connectable to a server device on the Internet based on the access right of the user of the terminal device in the management table;
Reducing the access right of the user of the terminal device in the management table and increasing the access right of the lender who has lent access through the relay device based on the Internet usage by the terminal device. A communication circuit that wirelessly communicates with a terminal device in a reception area, a first path for transmitting data from a target server computer on the Internet to the terminal device, and a target server computer on the Internet via a management server computer A relay computer for selecting a second route for transmitting data to the terminal device;
Determining means for acquiring user identification information from the terminal device and determining whether or not the user of the terminal device is the same as the owner of the relay computer;
When the user of the terminal device is not the same as the owner of the relay computer, the user identification information of the terminal device and the owner identification information of the relay computer are transferred to the target server computer, and the second route Means for determining as a data transfer path between the target server computer and the terminal device;
Relay computer, characterized in that it has e Bei a. The relay computer according to claim 9.
When the user of the terminal device is the same as the owner of the relay computer, the first route is provided as means for determining the data transfer route between the target server computer and the terminal device,
It is characterized by. A computer having a management table capable of communicating with a relay device that wirelessly communicates with a terminal device in a reception area and storing an access right for a user of the terminal device to access the Internet via a third-party relay device used, running the a management method for managing lending and borrowing of Internet connection bandwidth between the lender to lend access through the relay device to the user and the terminal device of the terminal device, the following processing in a computer Letting
Process of acquiring the lender identification information of the user identification information and the lender of the user,
A process for authenticating the user and the lender based on the user identification information and the lender identification information ;
Processing for enabling connection of the terminal device to a server device on the Internet based on the access right of the user of the terminal device in the management table;
A process of reducing the access right of the user of the terminal device in the management table and increasing the access right of the lender of the relay device by the reduced amount based on the Internet usage amount by the terminal device;
Lending and borrowing managing Internet connection bandwidth, wherein. A method for lending and borrowing an Internet connection band when a user of a wireless communication terminal device connects to the Internet via a third-party wireless communication relay device connected to the Internet,
In the management server connected to the Internet, the access right is stored for each user,
When the user gives a connection request including a user ID to the specific relay device from the terminal device, the specific relay device stores the given user ID and the storage unit of the relay device. The user ID is the same,
When the specific relay device determines that the user ID is different from the user ID, the specific relay device queries the management server whether the user specified by the user ID has an access right,
When the management server refers to the access right for each user and determines that the user has the access right, the management server replies that the relay device is accessible,
The relay device, upon receiving such a reply, enables the terminal device to connect to the Internet via the management server,
The management server decreases the access right of the user according to the connection and increases the access right of the user specified by the user ID stored in the relay device;
An internet connection bandwidth lending / borrowing management method.

Images